In absence of CORS configuration, WebSocket/SockJS allows same origin. Once an origin is added, same origin stops working (e.g. breaks in Chrome which sends an Origin header even even for same origin).
This doesn't seem intuitive. On the MVC side we seem to have chosen to allow same origin regardless, which makes more sense.
Rossen Stoyanchev opened SPR-13464 and commented
In absence of CORS configuration, WebSocket/SockJS allows same origin. Once an origin is added, same origin stops working (e.g. breaks in Chrome which sends an Origin header even even for same origin).
This doesn't seem intuitive. On the MVC side we seem to have chosen to allow same origin regardless, which makes more sense.
Let's consider this for 4.2.2.
Affects: 4.2.1
Referenced from: commits 299b776
The text was updated successfully, but these errors were encountered: